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ABSTRACT 


The  basic  objective  of  the  work  reported  herein  was  to  provide  a  broader 
technology  base  to  support  the  development  of  a  medium  STOL  Transport  (MST) 
airplane.  This  work  was  limited  to  the  application  of  the  externally  blown 
flap  (EBF)  powered  lift  concept. 

The  technology  of  EBF  STOL  aircraft  has  been  investigated  through 
analytical  studies,  wind  tunnel  testing,  flight  simulator  testing,  and  design 
trade  studies.  The  results  obtained  include  development  of  methods  for  the 
estimation  of  the  aerodynamic  characteristics  of  an  EBF  configuration,  STOL 
performance  estimation  methods,  safety  margins  for  takeoff  and  landing,  wind 
tunnel  investigation  of  the  effects  of  varying  EBF  system  geometry  parameters, 
configuration  definition  to  meet  MST  requirements,  trade  data  on  performance 
and  configuration  requirement  variations,  flight  control  system  mechanization 
trade  data,  handling  qualities  characteristics,  piloting  procedures,  and 
effects  of  applying  an  air  cushion  landing  system  to  the  MST. 

From  an  overall  assessment  of  study  results,  it  is  concluded  that  the 
EBF  concept  provides  a  practical  means  of  obtaining  STOL  performance  for  an 
MST  with  relatively  low  risk.  Sane  improvement  in  EBF  performance  could  be 
achieved  with  further  development  -  primarily  wind  tunnel  testing.  Further 
work  should  be  done  on  optimization  of  flight  controls,  definition  of  flying 
qualities  requirements,  and  development  of  piloting  procedures.  Considerable 
work  must  be  done  in  the  area  of  structural  design  criteria  relative  to  the 
effects  of  engine  exhaust  impingement  on  the  wing  and  flap  structure. 

This  report  is  arranged  in  six  volumes: 

Volume  I  -  Configuration  Definition 

Volume  II  -  Design  Compend ium 

Volume  III  •  Performance  Methods  and  Takeoff  and  Landing  Rules 

Volume  IV  -  Analysis  of  Data 

Volume  V  -  Flight  Control  Technology 

Part  1  -  Control  System  Mechanization  Trade  Studies 

Part  II  -  Simulation  Studies/Flight  Control  System  Validation 

Part  III  -  Stability  and  Control  Derivative  Accuracy 

Requirements  and  Effects  of  Augmentation  System  Design 

Volume  VI  -  Air  Cushion  Landing  System  Trade  Study 


I 


This  Volume,  V,  Part  I,  presents  the  results  of  trade  studies  of  five 
means  of  mechanisation  of  the  flight  control  system: 

•  Mechanical 

•  Mechanical  plus  stability  augmentation  (SAS) 

•  Mechanical  plus  control  and  stability  augmentation  (CASAS) 

•  Fly-by-wire  with  mechnical  backup 

•  Fly-by-wire 

The  fly-by-wire  mechnical  backup  system  was  found  to  be  most  suitable 
for  application  to  the  MST.  This  mechanization  met  all  system  requirements, 
and  while  heavier  by  694  pounds  than  its  nearest  coupe ti tor,  it  did  possess 
th©  lowest  system  failure  rate. 
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SECTION  I 
INTRODUCTION 


The  selection  of  the  most  suitable  flight  control  system  mechanization 
for  an  MST  aircraft  should  depend  on  trade-off  studies  specifically  related 
to  the  MST  and  its  particular  problems,  but  in  addition,  selection  of  con¬ 
cepts  and  mechanization  techniques  will  depend  on  company  experience  and 
knowledge  of  advanced  controls  technologies  and  data  available  throughout 
the  Air  Force  and  industry.  Rockwell  International  gained  a  wealth  of 
experience  and  design  capability  during  the  XB-70  design  and  test  program. 
Much  of  the  technology  gained  is  still  directly  applicable  to  MST  controls 
design  problems.  Designs  that  allow  for  sustained  operation  in  high  tem¬ 
perature-environments  and  designs  for  fail-safe  augmentation  servos  are 
examples  of  important  technology  that  can  carry  over  to  an  MST.  Following 
the  cancellation  of  the  Boeing  SST  program,  a  review  of  SST  control  con¬ 
cepts  and  hardware  was  made  for  applicability  to  the  B-l.  This  review 
provided  a  good  background  on  control  concepts  and  redundancy  techniques 
applicable  to  a  large  transport  aircraft.  This  review  also  provided  insight 
into  the  degree  of  complexity  involved  in  providing  built-in  test  capability 
in  a  multichannel  redundant  control  system.  McDonnell -Doug las ,  supported  by 
General  Electric,  LTV,  and  Sperry,  is  currently  involved  in  a  survivable 
flight  control  system  program  for  the  Air  Force,  which  is  providing  valuable 
fly-by-wire  design  data.  The  four- channel  redundant  augmentation  servo  could 
be  an  important  element  for  fly-by-wire  systems.  This  program  further 
emphasized  the  importance  of  built-in  test  equipment  to  the  success  of  fly¬ 
by-wire  systems. 

The  technology  advances  being  made  in  the  development  of  the  B-l  should 
have  considerable  applicability  in  the  development  of  an  MST.  The  B-l 
must  satisfy  stringent  flying  qualities  requirements  while  operating  over 
a  wide  range  of  mach,  altitude,  wing  position,  weight  and  CG  conditions. 

Also,  stringent  mission  success  and  flight  safety  reliability  requirements 
have  been  imposed.  Systems  developed  .to  satisfy  these  requirements 
certainly  provide  concepts  and  elements  for  strong  consideration  in  an  MST. 
The  summation  of  the  technology  advances  that  have  been  made  over  recent 
years  provides  an  excellent  background  for  the  development  of  a  flight  con¬ 
trol  system  specifically  applicable  to  an  MST  aircraft, 

Ih.roughout  the  history  of  flight,  control  system  weight  and  reliabilities 
have  become  increasingly  important  in  system  configuration  definition.  This 
is  especially  true  in  the  more  modem  days  of  STOL  aircraft,  because  of  the 
increased  complexity  of,  and  importance  attached  to,  the  control  system. 

The  increased  dependence  on  the  control  systems  for  performance  and  safety 
and  the  necessary  application  of  technology  advances  make  risk  in  development 


another  important  selection  consideration.  Cost  of  the  control  system  is 
also  closely  tied  to  its  final  selection.  Weight,  reliability,  cost,  and 
risk  of  development  are  considered  to  be  the  foremost  factors  that  must  be 
traded  off  in  the  selection  of  a  control  system  on  the  NET.  Inherent  in 
this  approach  is  the  assunption  that  all  systems  provide  satisfactory 
performance  during  normal  operation. 

The  mechanization  of  the  control  system  for  the  MST  involves  the  control 
of  spoilers  and  ailerons  for  roll,  the  horizontal  stabilizer  and  elevator 
for  pitch,  plus  the  inner  two  spoiler  panels  for  direct  lift  control,  and  the 
vertical  stabilizer  for  yaw  control.  These  aerodynamic  control  surfaces  plus 
their  actuation  systems  and  the  cockpit  controls  become  a  fixed  part  of  any 
control  system  to  be  evaluated.  This  leaves  the  intei connecting  portion 
of  the  system  to  be  developed,  and  trades  must  be  made  among  the  alternate 
systems. 


SECTION  II 


SYSTEM  ANALYSES 


BASIC  GROUND  RULES 

With  the  MST,  >'s  with  all  other  aircraft,  the  requirements  on  degree  and 
reliability  of  augmentation  are  determined  by  the  bare  airframe  Hying  qual¬ 
ities.  The  MST’s  bare  airframe  handling  qualities  are  such  that  control  and 
stability  augmentation  are  required  to  provide  Level  1  handling  qualities 
during  STOL  operations.  For  this  mode  of  flight  handling  qualities,  parameters 
were  evaluated  relative  to  specification  requirements  (refer  to  section  V, 
part  2)  to  insure  that  an  adequate  augmentation  system  was  included  for 
mechanization  comparisons.  Roll  and  yaw  augmentation  are  required  to  provide 
Level  1  flying  qualities  during  conventional  flight,  and  roll,  yaw,  and  pitch 
augmentation  are  required  to  provide  Level  1  flying  qualities  during  STOL 
flight.  Level  2  flying  qualities  are  provided  during  conventional  flight, 
and  Level  3  flying  qualities  are  provided  during  STOL  Hight  with  the  loss  of 
all  augmentation.  The  ground  roles  relative  to  Levels  2  and  3  for  STOL 
operation  are  based  on  simulation  tests.  (Reference  to  Volume  V,  Part  2, 
"Flight  Simulation  Studies,"  of  this  final  report.)  Gound  rules  relative 
to  conventional  flight  are  based  on  previous  analysis  and  experience. 

The  aircraft  hydraulic  and  electrical  system  design  is  also  governed  by 
the  requirements  of  the  flight  control  system.  These  requirements  are  that 
loss  of  one  hydraulic  or  electrical  system  shall  not  cause  reversion  to 
level  2  flying  qualities,  and  that  loss  of  two  hydraulic  or  two  electrical 
systems  shall  not  cause  reversion  to  worse  that  Level  3  flying  qualities. 

This  is  because  of  the  comparatively  high  failure  rates  of  these  systems, 
and  the  desire  not  to  have  a  failure  of  a  hydraulic  or  electrical  system 
result  in  a  degradation  of  flying  qualities.  In  addition  to  the  restriction 
of  degradation  of  flying  qualities  with  losses  of  hydraulic  supplies,  there 
are  also  restrictions  against  degradation  of  flying  qualities  with  any 
combination  of  failures.  These  restrictions  are  found  In  MIl-r-878$B,  which 
states  the  probability  of  encountering  Level  2,  as  a  result  of  a  combination 
of  failures  should  be  less  than  10’2,  per  mission,  and  that  the  probability 
of  reversion  to  Level  3  should  be  less  than  10*4  per  mission.  Not  found 
directly  in  MII-F-8785B,  are  the  requirements  for  loss  of  the  flight  control 
system.  This  is  a  goal  for  loss  of  control  of  the  aircraft  chargeable  to  the 
flight  system.  For  the  B-l  aircraft,  this  goal  was  set  at  about  2.0  x  10" ^ 
for  a  5-hour  mission.  For  the  MST,  being  a  transport  aircraft,  it  was  felt 
that  a  probability  goal  somewhat  lower  should  be  chosen.  This  is  because  of 
the  probability  of  having  passengers  aboard  with  no  escape  system  provided. 

A  goal  of  10* 5  for  a  5-hour  mission  wa*  chosen.  This  is  a  goal  that  is  not 
covered  by  any  military  specification;  however,  it  is  felt  that  it  will  be 


applicable  as  a  transport  flight  control  systems  goal  during  tie  1970's . 
Along  with  these  restrictions  are  the  somewhat  relieving  conditions  that 
Level  3  flying  qualities  will  be  provided  after  the  loss  of  any  two  roll 
control  spoiler  panels  or  an  aileron  per  wing  or  the  loss  of  rudder  con¬ 
trol,  with  the  rudder  near  neutral. 

The  air  vehicle  flying  qualities  and  flight  safety  requirements  that 
set  the  ground  rules  for  a  control  system  mechanization  study  are  summarized 
as  follows : 

1.  Loss  of  one  hydraulic  or  electrical  system  shall  not  cause  reversion 
to  Level  2  flying  qualities, 

2.  Loss  of  two  hydraulic  or  two  electrical  systems  shall  not  cause 
reversion  to  worse  than  Level  3  flying  qualities. 

3.  The  probability  of  any  combination  of  failures  causing  reversion  to 
Level  2  flying  qualities  in  any  axis  shall  be  less  than  10*^  for  a 
5-hour  mission. 

ihe  probability  of  any  combination  of  failures  causing  reversion  to 
Level  3  flying  qualities  in  an  axis  shall  be  less  than  10“ 4  for  a 
5-houi  micsian . 

5.  The  probability  of  any  combination  of  failures  causing  an  unsafe 
centre  1  condition  shall  be  less  than  10* 5  for  a  5-hour  mission. 

6.  During  STOL  mission  phases  the  pitch,  roll,  and  yaw  axes  of  control 
and  stability  augmentation  are  required  to  provide  Level  1  flying 
qualities,  and  roll  and  yaw  augmentation  are  required  to  provide 
Level  2  flying  qualities. 

7.  During  conventional  flight,  roll  and  ya r  axes  of  augmentation  are  . 
required  to  proviue  Level  1  flying  qualities,  level  2  flying 
qualities  are  pro'idod  with  ios  of  all  augmentation. 

8.  Level  3  flying  qualities  are  nrovided  in  all  mission  phases  with  the 
loss  of  any  two  ro)1  control  spoiler  panels  or  an  ai’vron  per  wing, 
and  the  less  of  ail  rudder  control  with  the  rudder  m.-ar  neutral. 


BASIC  POWER  ACTUATION  SYSTI-M 

Ihe  basic  end  point  of  any  control  system  mechanization  is  tho  controlled 
doflecticn  of  the  aorodyna’nic  control  surfaces.  With  an  air  vehicle  in  the 
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150,000-pound  class ,  and  with  the  requireirent  for  comparatively  light 
control  forces,  povered  surface  actuation  is  considered  a  basic  control 
system  requirement.  This  basic  actuation  system  will  be  common  to  any  control 
system  mechanization.  Also  common  to  any  control  system  mechanization  will 
be  the  pilot  and  copilot  cockpit  controls,  consisting  of  rudder  pedals, 
control  column  and  wheel,  and  trim  controls.  Since  any  control  system 
mechanization  includes  these  elements,  their  weights  and  reliabilities  will 
be  a  part  of  all  mechanizations  evaluated. 


Figure  1  presents  a  simplified  reliability  diagram  of  a  single -surface 
actuator  and  its  hydraulic  paver  supply.  The  nuirbers  shown  in  the  blocks 
indicate  failure  rates  per  million  flight  hours.  The  failure  rates  are  in 
series,  and  one  failure  will  cause  loss  of  control.  Hie  net  rate  is  0.622 
unsafe  conditions  per  10^  flight  hours,  or  a  potentially  major  accident 
every  1600  flying  hours  due  to  this  single  portion  of  the  control  system. 

This  is  obviously  unacceptable,  and  redundancy  is  required.  The  air  vehicle 
hydraulic  systems  are  not  considered  part  of  the  air  vehicle  flight  controls 
systems,  but  the  requirements  of  the  flight  controls,  and  other  systems, 
do  set  the  hydraulic  system  redundancy  requirements.  The  air  vehicle  has 
four-engines,  am;  each  engine  may  provide  an  independent  hydraulic  system. 

The  reliability  of  each  system  may  be  increased  by  providing  each  system 
with  dual  pump  systems,  thereby  greatly  reducing  the  cailure  probability 
of  this  portion  of  the  system.  Pump  duality  will  reduce  the  failure  rate  of 
this  portion  of  the  system  to  about  0,054  x  10'6  per  flight  hour;  this  does 
not  account  for  engine  failures,  or  the  parts  of  the  system  where  duality 
can  not  help.  These  parts  are  the  reservoirs  and  series  components  such  as 
plumbing  lines.  This  leaves  a  hydraulic  system  failure  rate  of  about 
3.65  x  10" ^  per  flight  hour,  providing  a  clear  requirement  for  redundant 
systems.  Supplying  a  single  actuator  with  dual  hydraulic  supplies  is  not 
practical  and,  since  a  single  actuator  system  would  cause  a  major  accident 
about  every  41  x  1Q+3  flight  hours,  redundant  actuators  are  also  a  require¬ 
ment.  To  insure  retention  of  at  least  Level  3  flying  qualities  after  two 
hydraulic  system  failures  for  any  reason,  including  engine  failures,  a 
minimum  of  three  actuators ,  each  powered  by  an  independent  hydraulic  system 
are  required.  Figure  2  presents  a  simplified  reliability  diagram  of  a 
triple  actuation  system  with  dual  feedback  and  input  control  linkages.  For 
a  flight  time  of  5  hours,  triple  redundancy'  of  the  actuators  and  hydraulic 
pcwer  supplies  essentially  precludes  loss  of  control,  except  for  those  failures 
classified  as  jams.  These  are  failures  which  cannot  he  un jammed  with  all 
available  force,  and  result  in  a  locked  control  surface  The  failure  prob¬ 
ability  for  a  5-hour  flight  is  about  0.3  x  lfr 6. 


Figure  3  presents  the  5-hour  mission  failure  probability  block  diagram 
of  the  fixed  portion  of  the  control  system,  the  control  surface  power 
actuation  subsystem.  In  this  type  of  representation,  any  continuous  path 
through  the  diagram  represents  a  situation  in  which  no  combination  of 
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Figure  1.  Single  Power  Actuation  Failure  Probability 


Actuation 


failures  has  resulted  in  loss  of  control.  The  net  calculated  failure 
probability  is  of  a  failure  or  combinations  of  failures  causing  a  discon¬ 
tinuity  in  the  chain.  The  roll  portion  of  the  system  is  shewn  in  parallel 
because  of  the  ground  rule  that  safe  control  can  be  maintained  with  the  loss 
of  an  aileron  or  two  spoiler  panels  per  wing.  Yaw  control  is  also  shown 
in  series;  however,  it  may  well  be  argued  that  a  safe  landing  could  be  made 
without  yaw  control.  The  loss  of  Level  1  flying  qualities  probabilities 
calculations  due  to  failures  in  these  parts  of  the  system  are  the  same  as 
the  unsafe  flight  probability  calculations,  except  all  of  the  roll  control 
has  been  placed  in  series. 

Figure  4  presents  a  schematic  of  the  pewer  actuation  system.  The 
resultant  unsafe  failure  probability  of  2.7  x  10  for  a  5-hour  mission  sets 
a  goal  of  no  more  than  7.3  x  10 for  the  signal  transmission  trade  study 
candidates.  The  loss  of  Level  1  flying  qualities  possibility  of  2.7  x  10~6 
sets  a  goal  of  10"^  for  these  systems. 

The  control  surface  power  actuation  system  estimated  weights  are  pre¬ 
sented  herein.  These  weights  present  a  basis  for  comparison  of  the  deltas 
added  by  the  trade  candidates.  The  weight  of  the  cockpit  controls  is  included 
here,  while  the  reliability  of  these  elements  is  included  in  the  para¬ 
graphs  on  the  mechanical  system. 

•  Horizontal  stabilizer  Three  single  actuators, 

including  valves,  dual 
control  linkage,  and 


plumbing,  68  lb (3).  204  lb 

•  hlevator  Three  actuators  152  lb 

•  Rudder  Three  actuators  152  lb 

•  Ailerons  Six  actuators  328  lb 

•  Roll  spoilers  Six  actuators  328  lb 

•  L'reet  lift  control  Six  actuators  328  lb 

•  Cockpit  controls  Two  sets  160  lb 

Total  1,652  lb 


(XMRU,  SYSTluM  SIGNAL  TRANSMISSION 
MICJIANICAL  SYSTEM 

The  first  control  system  trade  candidate  is  a  pure  moduli cal  system 
connecting  the  pilot’s  cockpit  control  columns,  wheels,  and  rudder  pedals  to 
the  aerodynamic  control  surface  power  actuation  systems.  It  is  a  set  of 
single  systems  consisting  of  the  he 11 cranks,  push  rods ,  cable  mis,  and 
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pulleys  that  connect  the  cockpit  controls  to  the  appropriate  input  control 
linkages  of  the  power  actuation  system.  It  also  supplies  artificial- feel 
and  trim  in  all  axis.  Figure  5  presents  simplified  schematics  of  the  system, 
along  with  lumped  system  disconnect  and  jam  failure  rates  per  million  flight 
hours.  The  rates  used  are  typical  of  these  classes  of  mechanical  components. 


m 


The  pitch  cable  run  is  ccasnected  through  pushrods  to  the  cockpit  control 
colums k  It  is  tapped  near  the  aircraft's  center  and  runs  are  supplied, 
tli rough  a  washout,  to  the  input  control  linkage  of  the  power  actuation  system 
for  the  direct  lift  control  (DLC) ,  inner  two  spoiler  panels  in  each  wing. 

A  cable  tension  regulator  bungee  is  located  at  the  terminal  of  the  cable 
system  near  the  tail.  At  this  point,  the  cable  system  is  divided  into  two 
functions.  One  function  controls  the  elevator  power  actuator  input  linkages 
through  a  flap  gearing  mechanism,  and  the  other  function  controls  the 
horizontal  stabilizer  power  actuator  input  linkages  through  a  different  flap 
gearing  mechanism.  Primary  trim  is  supplied  by  an  electrical  trim  actuator 
controlled  by  "coolie-hat"  switches  on  the  control  wheels.  Standby  trim 
is  provided  by  means  of  a  trim  wheel  located  on  the  center  console  mechan¬ 
ically  in  parallel  with  the  trim  actuator  geari'ij.  Secondary  power  switches 
are  provided  to  cut  power  to  the  trim  actuators  to  provide  protectioiyagainst 
runaway  trim. 

The  roll  cable  system  is  connected  through  pushrods  to  the  control 
wheels.  At  a  central  point,  the  system  is  divided  into  right-  and  left- 
hand  wing  control  functions.  Coble  tension  regulation  is  provided  at  this 
point.  The  right-  and  left-hand  control  functions  feed  out  through  the  wing 
to  control  the  outboai-d  two  spoiler  panels  and  aileron  power  actuation  system 
input  control  linkages.  Trim  and  feel  are  as  described  tor  the  pitch  system. 
Pitch  and  roll  primar>  trim  share  the  coolie-hat  trim  switches  locateo  on  the 
pilot  and  copilot  control  wheels. 

The  yaw  cable  system  is  connected  to  the  rudder  pedals  by  means  of 
pushrods.  The  cable  system  runs  to  the  tail  section  where  cable  tension 
regulation  is  provided.  The  output  of  the  cable  system  is  connected  to  the 
control  input  linkages  of  the  rudder  power  actuation  system  through  a  flap- 
controlled  limiting  function,  Tito  limiting  function  is  provided  to  restrict 
rudder  travel  at  tit©  higher  speed  flight  conditions. 

The  yaw  system  is  not  included  in  the  major  accident,  probabilities 
estimates.  The  yaw  system  failure  probabilities  were  estimated  for  flying 
qualities  degradation  probability  purposes;  however,  this  system  will  have 
the  probability  of  the  loss  of  yaw  control  of  1.6  x  10*^  due  to  system  dis¬ 
connects,  This  amounts  to  loss  of  yaw  control  due  to  all  causes  of  1.34  x 
10'4  for  a  5-hour  mission. 
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Figure  6  presents  the  Imped  parameter  failure  probabilities  of  the 
system.  The  single  mechanical  control  system  flight  safety  failure  prob¬ 
abilities  are  estimated  excluding  the  yaw  axis ,  and  roll  ailerons ,  and  pitch 
DLC,  except  for  jams.  This  net  system  has  a  disconnect  failure  rate  of 
4.68  x  10"**  per  hour  and  a  jam  rate  of  7.59  x  10“^  per  hour  or  a  net  major 
accident  rate  of  about  5.44  x  ID'S  per  hour.  A  5-hour  mission  would  result 
in  a  major  accident  probability  of  about  2.72  x  10'4.  This  is  an  unaccept¬ 
able  failure  rate.  Duality  would  decrease  the  loss  of  control  probability 
due  to  the  rate  of  disconnects  to  about  0,002  x  10"b  per  hour;  however,  the 
jam  rate  would  increase  to  about  1.52  x  10'$  per  hour,  and  the  weight 
would  about  double.  System  duality  would  result  in  a  major  accident  rate 
of  7.6  x  10"5  for  a  5-hour  mission,  and  a  system  weight  of  about  1,308  pounds 
for  a  total  of  2,960  pounds. 

Level  1  flying  qualities  will  not  be  supplied.  The  performance  of  this 
system  would  not  meet  the  flight  safety  noted  in  table  I.  The  system  per¬ 
formance  was  developed  to  provide  a  basepoint  about  which  stability 
augmentation  could  be  added  in  order  to  meet  the  flying  quality  requirements. 
The  system  weights  are  as  follows: 


Pitch 

Roll 

Yaw 

Cable  system 

109  lb 

196  lb- 

103  lb 

Direct  lift  control 

$7 

Trim  and  feel 

SI 

51 

33 

Flap  function 

36 

38 

- 

253  lb 

247  lb 

154  lb 

System  Total 

*  654  lb 

MiGlANICAL  CONTROL  PLUS  STABILITY  AUGCNTAITON 

The  second  system  trade  study  candidate  consists  of  the  dual  mechanical 
euntrol  system  combined  with  stability  augmentation  in  order  to  increase  the 
systems  performance  in  the  flying  qualities  areas.  The  system  provides 
stability  augmentation  in  all  axes  on  a  full-time  basis.  The  effects  of  the 
stability  augmentation  feedbacks  cat  control  sensitivities  are  compensated 
for  an  increased  command  path  gains  provided  by  gearing  changes  in  the 
mechanical  consumd  paths.  Level  1  Hying  qualities  are  provided  in  all  axes 
for  both  SiOL  and  conventional  flight.  For  the  purpose  of  this  study,  it 
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is  assumed  that  the  aircraft  provides  four  independent  electrical  systems. 
These  electrical  systems  are  provided  for  the  operation  of  systems  indepen¬ 
dent  of  the  flight  controls  system.  The  added  weight  to  the  electrical 
system  by  the  installation  of  electrical  flight  controls  was  not  calculated 
because  it  was  assumed,  that  it  would  be  the  same  for  all  of  the  systems. 

The  addition  of  stability  augmentation  requires  further  changes  to  the 
basic  mechanical  control  system.  Since  the  damping  motions  of  the  augmen¬ 
tation  servos  will  be  grounded  at  the  pilot’s  controls,  means  must  be  pro¬ 
vided  to  isolate  these  controls  from  objectionable  feedback  motions.  In  the 
yaw  system,  the  comparatively  heavier  feel  bungee  control  forces  and  breakout 
or  preload  characteristics  will  provide  adequate  pilot  isolation.  The  pitch 
and  roll  axes  have  lighter  feel  and  lower  breakout  forces.  Dual  tandem  master 
cylinders  were  added  to  each  of  the  pitch  and  roll  mechanical  control  systems, 
and  the  stability  augmentation  servo  outputs  are  summed  with  the  master 
cylinders  to  provide  control  over  the  power  actuation  systems.  The  yaw 
stability  augmentation  servo  output  is  directly  summed  with  the  yaw  cable 
system  output. 

A  functional  block  diagram  of  a  single  channel  type  system  is  shown 
in  figure  7,  along  with  estimated  weights  and  failure  rates.  Adequate 
system  performance  can  be  obtained  with  a  25-percent  servo  authority  limit. 

The  stability  augmentation  systems  consists  of  single -channel  electro- 
hydraulic  servos,  electronics,  inertial  sensors,  and  servo  monitors.  The 
monitors  consist  of  dynamic  shaping  networks  serving  as  servo  models.  The 
model  outputs  are  compared  to  the  actual  servo  displacement  in  response  to  the 
net  input  commands.  The  difference  between  the  model  and  servo  output 
is  fed  to  a  threshold  network,  and  an  excessive  error  between  the  signals 
will  operate  a  hydraulic  shutoff  valve,  and  the  servo  will  be  recentered. 

The  inertial  sensors  consist  of  rate  gyros  and  accelerometers  in  the  pitch 
and  yaw  axes,  and  a  rate  gyro  in  the  roll  axis.  The  estimated  weight  per 
axis  is  approximately  106  pounds  for  pitch  and  yaw,  51  pounds  for  roll,  and 
about  80  pounds  for  dual  tandem  master  cylinders  in  pitch  and  roll.  The 
estimated  failure  rates  are  4  x  10"4  per  hour  in  pitch  and  yaw,  and  1.8  x 
10‘4  per  hour  in  roll,  each  in  series  with  individual  hydraulic  system 
failure  rates  of  about  3.65  x  10'  per  hour.  The  system  would  add  about 
237  pounds  to  the  flight  control  system  weight  and  the  probability  of  the 
loss  of  an  axis  of  augmentation  during  a  5-hour  mission  be  about  0.82  x 
10-2.  The  system  would  be  subject  to  undetected  failures  upstream  of  the 
monitored  servo,  and  failures  are  about  1.25  x  10"4  per  flight  hour  for 
pitch  and  yaw  and  about  4.25  x  10'^  per  flight  hour  for  roll.  The  prob¬ 
ability  of  a  potentially  dangerous  failure  in  a  S-hour  mission  would  be 
about  8.38  x  10*4,  or  about  once  every  6,000  flight  hours.  These  failures 
would  be  hardovers  of  23  percent  control  authority.  A  mechanization  with 
a  fail-soft  capability  is  thus  required.  The  loss  of  stability  augmentation 
in  the  pitch  or  roll  axis  would  revert  the  axis  experiencing  the  loss  to 
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Level  3  flying  qualities  because  of  the  excessive  sensitivities  caused  by 
the  increased  mechanical  system  gains  and  loss  of  feedback  and  damping.  The 
probabilities  of  failure  of  the  pitch  or  roll  augmentation  would  be  about 
5.45  x  10 "3  for  a  5-hour  mission.  A  more  reliable  mechanization  with  a 
fail-safe  characteristic  is  required. 

A  triple  redundant  system  consisting  of  three  independent  channels  of 
sensors  and  electronics  controlling  three  independently  powered  electro- 
hydraulic  force  summed  servos,  or  two  active  and  a  model,  could  be  mechanized. 
This  system  would  have  a  loss  of  function  probability  on  the  order  of  0.6  x 
10‘4  for  pitch  and  roll  for  a  5-hour  mission.  The  failure  probability  is 
acceptable;  however,  the  failure  characteristics  are  still  unacceptable. 
Protection  against  hardover  failures  is  dependent  upon  the  remaining  active 
channels  or  channel  to  overpower  and  hold  the  failed  channel.  With  three  active 
channels ,  the  first  failure  could  be  made  acceptable ,  but  protection  against 
a  second  hardover  failure  would  depend  on  matched  hydraulic  supply  pressures. 
Normal  operating  hydraulic  systems  capable  of  doing  their  jobs  could  at  any 
time  be  mismatched  in  pressure  by  over  2S  percent.  This  would  allow  the 
failed  channel  to  drive  the  system  output  at  maximum  rate  until  the  failure 
was  detected  and  the  system  could  be  depcwered.  Dependence  on  monitoring 
with  rapid  cutoff  to  limit  control  surface  travel  to  acceptable  magnitudes 
is  self-defeating  because  of  the  lowered  reliability  caused  by  nuisance 
trip-outs  of  good  systems  due  to  normal  system  mismatches.  A  system  mec¬ 
hanization  based  on  velocity  summed  electromechanical  motors  could  also  be 
considered  a  candidate.  Ibis  system  would  provide  acceptable  system  failure 
rates,  but  again  the  system  second  failure  characteristics  would  be  unaccept¬ 
able.  Protection  against  a  hardover  second  failure  would  be  dependent  on 
maximum  velocity  matching  of  the  remaining  "good"  motor  and  the  failed 
motor.  This  matching  is  difficult  to  control,  and  normal  system  and 
electrical  supply  tolerances  could  result  in  terminal  velocity  mismatches  on 
the  order  of  30  percent  or  greater.  This  could  result  in  control  surface 
motion,  due  to  a  hardover  failure,  at  least  one -third  maximum  rate.  Limiting 
displacement  by  rapid  cutoff  would  result  in  the  same  problems  as  discussed 
for  tire  hydraulic  servo  system. 

To  overcome  tire  aforementioned  problems,  a  dual-dual  or  two  sots  of 
dual  tandem  electrohydraulic  servos  is  proposed.  Each  servo  would  be  car- 
trolled  by  identical,  but  independent,  channels  of  sensors  and  electronics. 

Each  servo  is  powered  by  an  independent  hydraulic  system,  with  the  piston 
pair  in  the  servo  powered  by  the  sail©  hydraulic  system.  This  insures  that 
matched  hydraulic  pressures  will  be  available  to  each  piston  pair  to  pro¬ 
vide  hardovei  failure  protection. 

Figure  8  presents  a  schematic  of  the  dual  tandem  fail-safe  servo  concept, 
lire  systems  are  provided  with  di ffe rental  1  hydraulic  flow  transducers 
which  provide  an  electrical  signal  proportioned  to  the  difference  in 
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hydraulic  flow  from  tire  two  valves.  This  signal  is  dynamically  shaped  and 
fed  back  with'  opposite  signs  to  the  two  systems  for  balancing.  Should  the 
balancer  be  unable  to  rebalance  a  system  mismatch  sufficient  to  bottom  the 
differential  transducer  in  about  3  seconds,  dual  series  shutoff  valves  would 
be  signaled  to  block  hydraulic  power,  and  the  system  would  be  re centered 
at  a  controlled  rate.  The  system  output  motion  resulting  from  the  failure 
and  balancer  action  could  be  controlled  to  an  acceptable  level.  The  dual 
channel  system  is  functionaly  a  single  system  with  controlled  failure  charac¬ 
teristics  and  double  the  single  channel  system  failure  rates.  The  two  dual 
systems  would  be  position  summed,  and  the  summed  position  would  be  fed  back 
to  the  individual  channels  to  hold  the  gain  reduction  to  an  acceptable  level 
in  the  event  of  a  single  failure. 

Figure  9  presents  a  schematic  of  the  fail -ope rational,  fail-safe  con¬ 
figuration.  The  probability  of  the  loss  of  pitch,  roll,  or  yaw  augmentation 
in  a  5-hour  mission  would  be  about  7.3  x  10"^.  The  system  provides  adequate 
flying  qualities  reliability,  and  has  acceptable  failure  characteristics. 

The  system  would  have  neglible  effect  on  the  loss  of  control  probability, 
which  would  remain  at  about  7.6  x  10"5  for  a  5-hour  mission.  The  system 
flight  safety  probabilities  still  do  not  match  the  requirements  of  10'^ 
set  forth  as  a  goal  for  a  transport  in  the  1970’s.  A  more  reliable  mech¬ 
anization  must  be  found.  The  pitch,  roll,  and  yaw  augmentation  system 
would  weigh  about  425  pounds  plus  about  80  pounds  for  two  dual  tandem 
master  cylinders  in  both  pitch  and  roll.  This  would  total  about  3,465  pounds 
per  shipset. 


MECHANICAL  CONTROL  PLUS  CONTROL  AUGMENTATION 

The  addition  of  the  fail -ope rational,  fail-safe  stability  augmentation 
to  the  basic  dual  mechanical  control  system  resulted  in  a  system  which 
provides  the  capability  of  increasing  system  performance  and  decreasing 
system  weight.  The  dual  mechanical  control  system  was  required  to  decrease 
the  loss  of  control  failure  probabilities  at  the  expense  of  about  654  pounds 
of  system  weight.  Hie  gearing  of  this  system  was  nonoptimum  for  operation 
without  stability  augmentation  in  the  pitch  and  roll  axis.  If  an  electrical 
control  path  were  to  be  added  to  the  stability  augmentation  systems,  the 
possibility  exists  of  eliminating  tho  duality  requirements  for  the  mechanical 
control  paths  mid  optimizing  them  for  operation  with  stability  augmentation 
failed.  ’Aner.  placed  in  parallel  with  single  mechanical  control  paths,  the 
electrical  control  paths  would  provide  control  redundancy  find  could  be 
optimized  for  operation  with  the  mechanical  control  system  and  stability 
augmentation. 

The  changes  to  the  stability  augmentation  system  would  be  an  increase 
in  servo  authority  to  100  percent  and  the  addition  of  quadruple  position 
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pickoffs  to  the  pilot’s  controls .  The  position  pickoffs  would  add  about 
24  pounds  to  the  augmencat-.on  system  weight  and  would  eliminate  about 
654  pounds  from  the  mechanical  control  system.  Performance  could  also  be 
improved  by  the  added  flexibility  for  matching  control  sensitivity  and 
dynamics  to  air  vehicle  response.  Inprovement  could  also  De  realized  in 
small  amplitude  control  because  of  better  resolution  characteristics  of 
the  electrically  controlled  servos. 

Figure  10  presents  a  simplified  schematic  of  the  pitch  axis,  less  the 
DLC,  utilizing  this  mechanization. 

For  loss  of  control  considerations,  the  mechanical  system  disconnect 
probabilities  are  in  parallel  with  the  electrical  control  and  stability 
augmentation  system  failure  probabilities.  As  before,  these  failure  proba¬ 
bilities  estimates  excluded  the  yaw  axis,  roll  ailerons  or  spoilers,  and 
pitch  DLC  except  for  jams.  All  jam  probabilities  are  added  in  series  wi  th 
the  foregoing  parallel  estimates.  For  a  5-hour  mission,  the  single  mechanical 
control  system  disconnect  probability  was  about  2.34  x  10*4,  the  fail- 
operational  electrical  control  system  failure  probability  would  be  about 
1.6  x  10"5.  This  wojold  result  in  a  loss  of  control,  for  ncmj armed  reasons, 
of  about  0.004  x  10"  .  The  probability  of  loss  of  control  because  of  a 
system  jam,  including  master  cylinder  and  servo  summing  linkages  would  be 
about  4.3  x  10" $  for  a  5-hour  mission.  The  system  weights  are  summarized 


as  follows: 

Power  actuation  system  and  cockpit  controls  1,652  lb 

Single  mechanical  control  system  654 

Control  and  stability  augmentation  system  449 

Pitch  and  roll  master  cylinders  80 

Controls  disconnect  20 

Total  system  weight  2,855  lb 


lire  inclusion  of  a  mechanical  system  disconnect  which  could  disconnect 
the  mechanical  system  in  the  event  of  a  jam  upstream  of  the  suasning  point 
of  the  master  cylinders  and  SCAS  servos  would  relieve  this  situation  to  some 
degree.  This  disconnect  would  connect  in  a  new  feel  bungee  and  disconnect  the 
jarred  mechanical  system.  It  would  also  increase  the  column  and  wheel  to 
surface  gains  to  condensate  for  tire  loss  of  the  mechanical  system.  Normal 
flight  could  be  continued  by  the  pilot  with  level  1  flying  qualities. 

Those  components  beyond  the  summing  linkage  would  be  dualed,  easing  the 
disconnect  problem,  but  doubling  tiro  jam  rates  to  the  input  of  the  power 
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actuation  system.  This  would  include  the  controls  to  the  spoiler  and 
ailerons  in  the  wings  and  the  flap  gearing  in  the  pitch  system.  This 
would  mean  a  jam  rate  of  2.6  x  10"6  per  hour  for  roll,  and  0.25  x  10'6 
for  pitch  for  a  total  of  2.85  x  10'^  per  hour  plus  that  of  the  pcwer 
actuations  system,  about  2.7  x  10'6  per  hour,  and  about  one-half  of  the 
disconnect  and  jam  rates  of  the  control  column  and  wheel,  about  0.06  x 
10-6  per  hour.  This  would  amount  to  a  not  total  of  about  5.11  x  10*6 
per  hour,  this  would  result  in  a  less  of  control  probability  of  about 
2.5  x  10"5,  based  on  a  5 -hour  mission.  This  exceeds  the  flight  safety 
goal  of  10‘5  by  a  good  margin;  however,  the  development  risk  of  this  type 
of  system  would  be  low.  The  CASAS,  with  the  disconnectable  mechanical 
system  is  essentially  the  same  as  that  being  developed  for  the  B-l.  The 
CASAS  has  been  flight  test  proven  on  the  F-100,  F-107,  and  the  XB-70,  as  well 
as  many  hours  of  flight  simulation  effort. 


FLY-BY-WIRE  CONTROL  WITH  MECHANICAL  REVERSION 

A  flight  control  system  based  on  fly-by-wire  with  a  mechanical  control 
system  for  backup  is  considered  as  a  trade  candidate.  This  system  would 
feature  a  single  mechanical  control  system  in  each  axis ,  as  previously 
described.  These  systems  are  less  the  dual  tandem  hydraulic  master 
cylinders,  and  have  mechanical  gearing  changers  located  at  the  pilot’s 
stations.  These  gearing  changes  normally  have  the  mechanical  system  disengaged 
from  the  cockpit  controls,  and  control  is  maintained  through  the  control 
and  stability  augmentation  system.  The  outputs  of  the  mechanical  system 
are  directly  summed  with  the  outputs  of  the  electrohydraulic  servos.  The 
master  cylinders  are  not  required,  since  the  system  is  disengaged  under 
normal  conditions . 


The  pitch  axis  DLC  is  electrically  driven  by  a  fail-operational,  fail- 
closed  electrical  motor  velocity  s  unwed  system.  Figure  11  presents  a 
simplified  failure  probabilities  schematic  of  this  system.  There  is  one  of 
this  typo  of  system  in  each  wing.  In  the  event  of  a  second  failure  in 
either  of  the  two  systems,  both  are  shut  down,  and  the  power  actuator  con¬ 
trols  are  bungee  driven  to  the  closed  positions.  Tire  system  has  a  failure 
probability  of  about  2.8  x  10’$  per  hour  for  a  5-hour  mission.  Level  2 
flying  qualities  is  retained  after  a  system  failure. 


The  control  and  stability  augmentation  system  operates  to  maintain 
trim  and  give  the  pilots  full  control  over  the  operational  range  of  the 
air  vehicle.  The  servo  action  is  essentially  die  same  as  described  in  the 
preceding  section,  except  that  they  are  hooked  up  differently.  They  are 
fail* ope rational  twice;  that  is,  it  would  take  three  failures  to  cause  the 
system  to  refuse  control.  Four  actuation  systems  would  he  assigned  to 
roll,  one  at  each  aileron,  and  one  at  each  of  die  spoiler  inputs,  two  for 
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pitch  and  one  for  yaw.  Two  systems  will  be  considered,  four  active  servos 
force  summed,  and  four  limited  position  summed  single  systems.  . 

Figure  12  presents  simplified  schematic  diagram  of  the  difference 
between  the  two  systems.  The  outputs  of  the  mechanical  backup  system  are 
summed  with  this  system,  but  normally  are  zero.  Bach  system  is  provided  with 
an  independent  electrical  and  hydraulic  pcwer  supply. 

The  first  system  to  be  examined  is  the  force  summed  system.  Figure  13 
presents  a  schematic  of  this  system.  This  system  contains  four  servos  with 
the  outputs  tied  together.  These  servos  are  force  summed  at  the  outputs, 
and,  as  such,  they  will  require  pressure  balancing  to  bring  the  pressures 
into  the  range  where  there  will  be  acceptable  operation.  A  median  signal 
selector  is  used  to  pick  off  a  median  differential  pressure,  and  this  pres¬ 
sure  is  compared  to  the  individual  servo  differential  pressures.  The  error 
between  the  differential  pressures  is  shaped  and  fed  back  to  the  values  in 
a  sense  to  neutralize  them.  The  differential  pressure  is  picked  off  by 
differential  pressure  transducers  across  each  piston.  If  a  signal  is  fed 
to  one  servo,  and  the  balancer  cannot  neutralize  the  resultant  pressure 
differential  within  a  specified  time,  that  servo  is  shut  down  and  bypassed. 
After  two  failures,  the  system. remains  in  operation  until  a  third  failure 
causes  it  to  become  uncontrolled.  After  the  third  failure,  the  system  is 
shut  down  and  recentered  by  bungee  action.  The  pilot  then  uses  his 
emergency  backup  mechanical  system  to  maintain  control  of  the  aircraft,  and 
land  it.  The  first  and  second  failures  will  be  acceptable  because  they 
will  have  at  least  two  good  servos  to  buck  out  the  failed  servo.  The  con¬ 
trol  surface  transients  resulting  from  these  failure?  are  a  function  of  the 
rates  assigned  to  the  pressure  balancer  and,  as  such,  are  directly  controlled 
by  the  system  designer. 

As  a  result  of  this  short  analysis,  it  can  be  seen  that  this  system 
is  acceptable  from  an  operational  point  cf  view.  It  remains  new  to  analyze 
its  tallure  probabilities.  Figure  14  presents  a  simplified  reliability 
diagram  of  the  system.  To  start  with,  the  cockpit  control  and  surface 
actuator  systems  have  a  failure  rate  of  about  3.2  x  10'6  for  a  5-hour  mission. 
What  remains  lies  in  between  these  two  elements.  If  the  systom  lying  in 
between  can  be  found  to  have  a  failure  rate  of  less  than  6.S  x  10*^  for  the 
5-hour  mission,  a>  *  of  the  systems  requirements  will  be  mot.  With  reference 
to  figure  14,  it  can  be  seen  taut  the  systems  have  a  net  failure  rate  of 
about  2,6  x  10 'b.  ThL.  summo'*  with  the  output  stages,  control  column,  and 
wheel  and  hydraulic  system-  will  result  in  about  5.8  x  1,0'6  for  the  overall 
system.  The  reversion  to  the  reehanical  system  would  have  a  probability 
of  occurrence  of  about  2.55  x  The  failure  analysis  is  applicable  to 

both  systems. 

The  second  system  to  bo  looked  at  consists  of  four  servos,  the  outputs 
of  which  are  position  summed.  This  alleviates  the  need  for  pressure 
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Figure  14,  Fly-by -Wire  Plus  Mechanical  Backup  Failure  Probabilities 


balancing  the  servos  to  obtain  normal  working  conditions.  The  servos  are 
summed  on  walking  beams,  and  are  restricted  in  travel  to  50  percent  of  the 
rated  output.  This  gives  the  servo  set  200  percent  authority  with  all  servos 
working,  and  100  percent  authority  with  two  failures.  There  are  override 
bungees  placed  in  the  summed  linkages  to  absorb  over  travel,  feedback  is 
provided  around  each  servo,  and  from  the  summed  output.  A  hardover  signal 
into  one  of  the  servos  would  cause  it  to  go  hardover.  The  feedbacks  in  the 
other  channels  would  act  to  overcome  the  output  motion  due  to  the  failed 
servo .  After  some  time  delay,  the  voted  bad  servo  would  be  cut  off  and 
recentered,  the  second  failure  would  be  much  the  same  as  the  first,  except 
that  there  would  oe  only  two  servos  left  to  overcome  the  failed  servo.  The 
first  failure  will  be  opposed  by  three  working  systems,  and  the  second 
failure  will  be  opposed  by  two  working  systems.  The  input  to  the  control 
surface  due  to  a  failure  is  a  function  of  the  preceding  failure,  the  gain 
of  the  feedback  from  the  summing  linkage,  the  authority  of  each  servo,  and 
the.- gain  cf  the  feedbacks  assigned  to  the  inertial  feedback  sens  ore.  The 
first  failure  could  drive  the  summing  linkage,  with  the  three  remaining 
servos  opposing  the  uncommanded  motion.  If  the  summed  output  feedbacks  are 
made  five  to  one  for  the  individual  servo  feedbacks  and  the  response  feed¬ 
back  were  made  one,  then  the  response  to  a  first  failure  would  be  about 
0.05  g.  This  is  acceptable,  and  the  second  failure  would  result  in  about 
0.07  g.  This  is  acceptable.  Hie  actual  feedback  ratio  used  would  depend 
on  the  vehicle  gains  however,  these  numbers  are  representative  of  the  air¬ 
craft  under  consideration. 

The  failure  rate  of  this  system  will  be  about  the  same  as  the  preceding 
force  summed  system.  With  both  systems  having  about  the  same  order  of 
magnitude  of  failure  rates,  and  the  same  order  of  recovery,  then  special 
thought  must  be  given  co  choosing  between  the  two.  The  pressure  balanced 
system  is  much  like  the  present  B-l  system.  The  pressure  balancer  replaces  the 
flow  integrator,  and  the  inputs  are  selected,  however,  the  basic  system 
is  similar  to  the  E-l  system.  The  position  system  is  similar  only  in  that 
the  outputs  are  position  summed,  however,  the  basic  system  is  different. 

In  order  to  be  able  to  predict  the  resultant  g's  that  follow  a  hardover 
failure,  the  aircraft's  flight  characteristics  must  be  predicted  very  closely, 
and  the  systems  aerodynamic  gains  must  be  made  precisely.  The  pressure 
summed  system  would  give  the  system  designer  a  much  closer  control  of  this 
function,  with  less  dependence  upon  the  aerody\amic  gains.  The  mechanical 
backup  system  removes  the  doubt  that  goes  with  a  fly-by-wire  system,  and 
the  pressure  balanced  system  is  chosen  as  the  candidate.  The  following 
presents  a  weight  breakdown  of  the  system: 

Power  actuation  system  and  cockpit  controls  1,652  lb 

Control  and  stability  augmentation  system  609 
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Single  mechanical  control  s>stem 
Controls  disconnect 

Total  system  weight 


FLY- BY- WIRE  CONTROL 

The  flight  control  system  could  be  made  lighter  if  the  mechanical 
backup  control  system  could  be  removed.  This  could  be  done  if  the  proba¬ 
bility  of  reversion  to  the  mechanical  control  system  were  below  6  x  10“^ 
for  a  5-hour  mission.  Based  strictly  on  the  failure  rate  data  that  are 
available  for  use  today,  this  is  possible.  In  the  preceding  paragraphs, 
it  was  seen  that  the  control  surface  system  including  the  mechanical 
system  had  a  failure  probability  on  the  order  of  5.8  x  10"^  for  a  5-hour 
mission,  and  that  the  fly-by-wire  system  with  the  mechanical  backup  system 
disconnected  had  a  failure  probability  of  about  2.55  x  10’&.  This  means 
that  removal  of  the  mechanical  backup  system  would  increase  the  failure 
rate  by  2.55  x  10“^  for  a  total  of  about  8.35  x  10"^  for  a  5-hour  mission. 
The  increase  in  failure  allotment  appears  to  be  reasonable  if  the  electrical 
failure  rates  can  be  sustained. 

The  electrical  failure  rates  appear  realistic  on  the  surface;  however, 
they  do  not  account  for  such  phenomena  as  a  complete  electrical  system 
failure.  Such  a  complete  electrical  system  failure  might  be  very  rare  in 
the  life  time  of  the  air  vehicle.  However,  even  something  as  rare  as  this 
may  become  tactically  unacceptable  when  it  results  in  the  loss  of  the  air¬ 
craft.  Such  failure  may  result  from  lighting  strikes  on  the  air  vehicle, 
best  known  of  the  phenomena  which  cause  breakdown  of  aircraft  electrical 
systems.  This  consideration  is  particularly  important  if  the  vehicle  is 
an  all-weather  aircraft.  No  attempt  will  be  made  at  this  time  to  trace 
out  the  exact  course  of  the  happenings  that  cause  the  loss  of  electrical 
pwer.  Sufficient  to  say  at  this  point  that  such  electrical  problems  have 
existed  in  the  past  and  regardless  of  tire  causes,  these  problems  still  rep re- 
sent  a  significant  risk.  In  addition  to  the  electrical  system  problems, 
there  are  the  problems  of  environment,  neutron,  mid  electromagnetic  inter¬ 
ference,  and  development  risk.  The  problem  of  development  risk  should  not 
he  bypassed  lightly.  It  is  tins  risk  which  must  be  considered  when  entering 
flight  test  with  no  backup  system  to  save  the  air  vehicle  in  case  of 
designer's  calculation  are  wrong. 

This  system  would  be  essentially  like  the  fiv-by-wire  system  with  the 
standby  mechanical  system.  The  dual  outputs  would  be  fed  directly  to  the 
dual  inputs  of  the  power  actuation  system.  Level  1  flying  qualities  would 
he  provided  in  all  flight  regimes  with  a  probability  of  loss  of  8.89  x  10‘(> 
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20 
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for  a  5-hour  mission.  The  probability  of  loss  of  control  would  be  8.35  x 
10*6.  SyStems  weights  would  be  the  fly-by-wire  with  mechanical  backup 
less  the  mechanical  system.  The  systems  weights  are  as  follows: 


Power  actuation  system  plus  cockpit  control 


1,652  lb 


Control  and  stability  augmentation 


Total  weight 


2,261  lb 


AUTOMATIC  FLIGHT  CONTROL 

The  addition  of  an  automatic  flight  control  system  to  the  basic  control 
system  is  quite  straightforward.  This  system  provides  considerable  pilot 
duty  relief,  at  a  cost  of  approximately  50  pounds  of  installed  weight. 

This  control  system  consists  of  the  central  air  data  system,  the  platform,  a 
coupler,  and  the  stability  augmentation  system.  It  functions  to  maintain 
the  flight  path  of  the  aircraft  under  constant  surveillance  and  control 
when  engaged.  The  system  would  provide  roll  angle  hold  in  the  roll  axis , 
and  the  flight  path  or  altitude  hold  in  the  pitch  axis.  When  the  control 
column  or  wheel  is  moved  away  from  neutral,  the  system  synchronizes  the 
incoming  signal.  This  is  done  to  insure  that  the  values  existing  at  the 
time  that  the  cockpit  controls  are  placed  back  in  neutral  will  be  held. 

These  values  are  wings  level  or  beyond  say  *2.5  degrees  to  *45  degrees 
the  attitude  existing  at  the  time  of  centering  the  controls.  In  pitch, 
the  value  held  would  be  altitude  if  belcw  a  given  flight  path  angle  and 
flight  path  angle  if  above  say  *1  degree.  Other  modes  of  operation  are 
available  by  special  selection.  These  modes  are  airspeed  or  mach  number 
hold,  automatic  navigation,  automatic  landing,  and  whatever  other  modes 
may  make  themselves  known  as  the  aircraft  is  developed. 

The  system  is  dualed  all  the  way  from  the  sensors  to  the  input  to  the 
augmentation  servos.  Hie  reason  for  this  is  really  self-explanatory  in 
concept.  A  single  system  can  put  in  a  larger  input  that  can  be  tolerated 
during  a  hardovor  failure.  The  two  systems  are  monitored,  and  a  difference 
between  them  causes  a  system  shutdown  when  this  difference  exists  over  a 
time  span  of  say  1/2  to  1  second,  and  is  of  a  fairly  large  magnitude.  The 
system  is  nonswapping,  that  is  it  does  not  switch  from  one  signal  to  another 
during  operation.  It  remains  with  the  same  .signal  until  it  is  shutdown. 
Shutdown  would  have  a  probability  of  about  10'*  in  a  5-hour  mission.  This  is 
comparable  to  about  20  failures  every  20,000  5-hour  missions.  This  is 
considered  to  bo  adequate  mission  reliability. 

This  automatic  flight  control  capability  could  be  added  to  any  of  the 
systems  previously  discussed,  but  does  not  provide  an  alternate  method  with 
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functional  capability  provided  by  those  systems.  Consequently 
it  been  included  in  the  mechanization  comparisons  discussed  in 
:tions. 


SECTION  III 


SYSTEM  CHARACTERISTICS  COMPARISON 


A  summary  of  all  of  the  control  systems  studied  is  presented  in  table  I. 
This  table  starts  at  the  top  with  the  mechanical  system  and  works  down  to  fly¬ 
by-wire  at  the  bottom.  This  table  summarizes  the  systems  versus  the  system 
requirements,  as  presented  in  section  II.  In  this  table,  it  can  be  seen 
that  the  nechanical  control  system  meets  only  requirements  2,4,  and  8  of 
the  basic  requirements,  while  missing  requirements  1,  3,  5,  6,  and  7.  The 
systems  composed  of  the  mechanical  system  plus  SAS  and  mechanical  plus 
CASAS  meet  all  system  requirements,  except  for  loss  of  control,  requirement  5. 
The  systems  composed  of  fly-by-wire  with  dormant  mechanical  system  backup 
and  the  fly-by-wire  system  meet  all  system  requirements.  The  requirement 
represented  by  number  5  says  simply  that  the  combination  of  any  failures 
causing  an  unsafe  flight -condition  to  exist  shall  have  a  probability  of 
occurrence  less  than  10  for  a  5-hour  mission. 

The  fly-by-wire  systems  are  the  only  systems  that  meet  this  requirement. 
This  is  primarily  due  to  the  placement  of  servos  at  the  power  actuators  and 
the  removal  of  the  mechanical  system  jam  rates  that  occur  between  centrally 
located  servos  and  the  power  actuation  system.  Table  II  presents  a  summary 
of  all  of  the  systems  weights.  This  table  includes  the  weights  of  single 
and  dual  mechanical  systems,  single  and  dual  SAS,  the  basic  power  actuation 
and  cockpit  control  systems,  and  the  weights  of  the  fly-by-wire  systems. 

This  table  was  included  to  provide  the  background  for  the  weight  summary 
presented  in  table  III.  Table  III  also  presents  the  probabilities  of  loss 
of  control  and  loss  of  Level  1  flying  qualities  for  each  of  the  systems 
under  consideration.  Table  III  secs  the  basic  background  for  the  selection 
of  the  control  system  recommended  for  the  MST. 

Table  IV  presents  a  more  detailed  summary  of  ♦•he  systems  without  regard 
to  the  system  requirements.  In  this  table,  the  cost  of  added  system  weight; 
the  cost  of  the  probability  of  loss  of  control;  the  cost  of  the  probability 
of  loss  of  Level  1  flying  qualities;  procurement,  development,  design  and 
analysis,  and  maintenance  costs;  and  the  cost  of  risk  of  development  are 
presented.  For  each  of  the  systems,  these  relative  costs  were  developed  from 
the  following  set  of  generalized  equations: 

1.  Cost  of  added  weight; 

This  section  considers  only  the  cost  of  a  larger  aircraft 
plus  the  added  cost  of  operating  the  larger  aircraft. 


ICNTROL  SYSTBi  WEIGHTS  (POUNDS) 


©  BASIC  POWER  ACTUATION  AND  COCKPIT  CONTROLS 


(7)  MECHANICAL  CONTROLS.,  FEEL,  LINKAGE,  TRIM  (SINGLE  SYSTEM) 
Cable  system 
DLC 

Trim  ana  feel 
Flap  functions 
Total 


Q  MECHANICAL  CONTROL  SYSTEM 


©+2©  ■  basic  and  dual  mech 
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Roll 
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Master  cylinders 

80 

Basic  and  dual  raech 

2,960 

Total 

3,197 

(4b)  MECHANICAL  AND  SAS  (DUAL  SAS  AND  DUAL  MECH) 

I - 

Pitch  and  yaw  (dual) 

■ 

212 
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2,960 

Total 

3,465 

2*261 


fe  ^ 
o  o 


gas 


fe  tfe  vj 

oog 

ggi 

£38 


vo 

o 

LO 

ai 

vD 

CO 

fH 

CM 

to 

• 

*. 

t-- 

00 

O 

1 

KJ 

LO 

CM 

vO 

to 

I 

O 

CTl 

•  i 

* 

< 

VO 

«"  ! 

00 

LT>  1 

00 

o  1 

o 

rH 

r- 

to 

i-H 

r-4 

m 

• 

• 

• 

o 

o 

o 

to 

LO 

t*". 

to 

to 

t -i 

o 

o 

o 

o 

o 

• 

1 

• 

o 

o 

o 

I  1 

cu  a, 


3  3  1 

MM  W4  I 

I  I  fi 

a  &  >. 

SB  S  c! 


A  cost  of  added  wt  =  fo^ars  ,  X  Awt  X  growth  factor 

pounds  a/c 

+  A  operating  cost 

Where  each  of  the  preceding  factors  were  assigned  the  following 
values : 


dollars 


pounds  a/c 


$7  X  10 


+6 


.+6 


=  $ 6 8 /pound 


0.103  X  10  pounds 
AWt  -  weight  of  system  under  consideration  -  weight  of 

fly- by-wire  system;  growth  factor  =  3  pounds /pounds ; 

ofmissi 
a/c  life 


.  . .  .  dir  op  cost  v  Mo.  of  missions 

a  operating  cost  =  — -t-tt— —  X 


mission 


Awt  X  growth  factor  ,  dir  op  cost  _  $5,00 
103  X  10+®  pounds  *  W  ere  mission  '  missi 


pounds 

,  missions  ^  „  1rt3 
and  — -mr-*  2  X  10 


000 

mission 


a/c  life 

The  direct  operating  costs  were  based  on  the  costs  of  operating 
a  C-141,  and  include  fuel,  expendables,  direct  maintenance,  crew 
upkeep,  and  replaceable  spares,  with  allowance  for  different 
operating  conditions.  The  delta  weight  times  growth  factor  over 
nominal  weight  was  determined  as  follows: 


Mech.  system 

Mtch.  plus  SAS 

Mech.  plus  CASAS 

Fly-by-wire  plus 
mech  backup 


(2,960  -  2,261)  lb  X  3 

oToTTTo’nE -  °'021 

(3,465  -  2,261;  lb  X  3 


0.103  X  10^  lb 


*•  )  y  01  J 
ThrtJ  if 


»  0.035 


(2,855  •  2,201)  lb  X  3  n,7 

■OTTHJ^TE - 0,°*' 


it J  a  0.0202 

0.103  X  10*&  lb  y “ 


Cost  of  probability  of  loss  of  control: 

.  dollars  v  probability  of  loss  of  control  v  missions 
f  a/c  mission  a/c 

. .  dollars  ^  ,,  v  ,no 
where  — -r-~  *  $7  X  10 
a/c 
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3,  Cost  of  probability  of  loss  of  Level  1  flying  qualities: 

C  p  t i  dollars  probability  of  mission  abort  ^  missions 
05  t  1  mission  *  mission  a/c  life 


Probability  of  mission  abort  =  probability  of  loss  of  level  1 
7  mission  mission 

Dollars  __  operating  cost  maintenance  cost  +  cargo  cost 
Mission  mission  mission  -  mission  ~ 


operating  cost 
Mission 


$5,000 


Maintenance  cost  _  maintenance  hr  ^  dollars 


Mission 


mission 


maint  hr 


100  X  600  =  $60,000 


Cargo  cost  dollars  v 

mils; - rr- 11  lb  carg0 


5  X  28,000  =  $140,000 


Dollars 

Mission 


5,000  +  60,000  ♦  140,000 


a  $0.205  X  106 
mission 


4.  Cost  of  procurement  development,  design  and  analysis,  and 
maintenance : 


Cost  a  procurement  *  maintenance  cost 

The  augmentation  system,  consisting  of  mechanical  plus  S4S  and  CASAS 
and  fly-by-wire  with  mechanical  backup,  will  require  about  twice  as 
much  analysis,  design  effort,  mid  testing  as  the  purely  mechanical 
system,  and  will  cost  at  least  twice  as  much  to  procure.  The  mechani¬ 
cal  plus  SAS  must  be  given  a  slightly  higher  cost  factor  than  the 
mechanical  plus  CASAS  or  the  fly-by-wire  with  mechanical  backup, 
because  of  the  loss  of  flexibility  in  the  design  and  the  resultant 
need  for  more  analysis  effort.  The  fly-by-wire  with  mechanical 
backup  will  cost  about  1C  percent  more  than  the  mechanical  plus 
CASAS,  because  of  the  additional  design  and  analysis.  The  fly-by¬ 
wire  alone  system  must  be  given  a  cost  factor  of  about  1.25  times 
that  of  the  mechanical  plus  CASAS  or  fly-by-wire  with  mechanical 
backup,  because  of  the  increased  analysis,  design,  procurement, 
testing,  and  maintenance  costs  associated  with  the  required  additional 
bull tin  test  requirements.  A  factor  of  3  percent  of  the  procurement 
costs  of  the  airframe  was  used  as  the  cost  of  ti»  mechanical  system. 
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With  the  aforementioned  in  mind,  the  following  were  set  up  as  the 
procurement  costs  per  system: 

Mech  system:  Cost  =  0.03  X  $7  X  106  =  $0.21  X  106 

Mech  system  +  SAS:  Cost  =  $0.21  X  106  X  2  X  1.05  =  $0.44  X  106 

Mech  system  +  CASAS:  Cost  =  $0.21  X  106  X  2  ■  $0.42  X  106 

Fly-by -wire  with  mech  system  backup:  Cost  -  $0.21  X  10^  X  2  X  1.1 

=  $0,463  X  106 

Fly-by-wire:  Cost  =  $0.21  X  106  X  2  X  1.25  «  $0,535  X  106 


The  system  maintenance  costs  were  set  up  as  follows: 

.....  .  dollars  v  fit  cont  maint  hr  v  missions 

maint  nr  mission  a/c  life 

Where  fit  maint  hr  3  3  mech  system 

mission  5  mech  system  plus  SAS  or  CASAS 

6  fly-by- wire  plus  mech  backup 

7  fly-by-wire 


and 


dollars 


$60Q/hr 


maint  hrs 
5.  Cost  of  risk: 

The  cost  of  risk  of  development  computed  as  follows: 

r  ..  ,  .  dollars  prob  of  unpred  unsafe  failure  during 
0  1  *  aTc  '  prob  of  Uipred  tmSaTe  Failure  during 

sys  do vtnt  ..  prob  of  failure  of  immature  system  .. 

mech  sys  devmt  ‘  prob  "6  f  YSiTure  ofmature  system 

.AK m&m  * .stasi*. . J7 s w'Swu * * * io‘ 

No.  of  devm  missions  •  $1 ,060  X  Kr  X  No.  of  devtnt  missions;  where 


Mech 

Mech  *  SAS 
Nfeeh  •  OVSAS 


SI ,060  X  Kr  X  No.  of  mission  *  total 

i 

SI, 060  X  1.0  X  SO  *  SO. 053  10 1 

SI, 060  X  1.5  X  ?$  *  SO. lid 5  X  totJ 
Si, 060  X  1.3  X  73  *  $0.Ua5  X  10° 


Fly-by-wire  with 
mech  backup 

Fly-by-wire 


$1,060  X  1.6  X  100  =  $0,170  X  106 
$1,060  X  5.0  X  100  =  $0,530  X  106 


To  use  the  preceding  relationships,  the  cost  of  each  of  the  systems  was 
calculated  and  entered  into  table  IV.  The  following  is  a  sample  of  these 
calculations  as  made  for  the  fly-by-wire  with  dormant  mechanical  backup. 

1.  Cost  of  added  weight: 

$  added  weight  =  $68  (2,955  -  2,261)  3  +  $5,000  X  2  X  103 
X  Q^fo3~f'io6  =  $6*141  x  1q6  *  $'  0-202  X  106  =  $0,343  X  106 

2.  Cost  of  probability  of  loss  of  control: 

$PfLC  •  $7  X  106  X  5.8  X  10"6  X  2  X  103  =  $0.08  X  106 

3.  Cost  of  probability  of  loss  of  Level  1  flying  qualities: 

$P£L1  =  $0,205  X  106  X  8.89  X  10'6  X  2  X  103  ■  $0.0035  X  106 

4.  Cost  of  procurement,  development,  design  and  analysis,  and 
maintenance : 

$P  6  M  =  $0,463  X  106  +  $600  X  6  X  2  X  103  »  ($0,463  +  $7.2)  106 
=  $7,663  X  106 


5.  Cost  of  risk  cf  development: 

$  risk  =  $7  X  106  X  1.6  X  2  X  76  X  1C)'6  X  100  »  $0,170  X  106 
Total  -  ($0,345  +  $0,081  +  $0.0035  +  $7,663  +  $0.17)  106  =  $8,260 
X  106 

These  values  were  entered  into  table  TV,  along  with  the  systems  total 
costs. 

Examination  of  table  IV  will  show  that  the  procurement  plus  maintenance 
cost  outweighs  all  other  costs.  There  are  several  causes  for  this.  In  the 
cost  of  loss  of  control,  only  the  cost  of  the  lost  aircraft  is  considered. 
This  does  not  consider  that  cost  of  the  probable  loss  of  a  combat  trained 


crew,  or  their  replacements.  In  the  mission  abort  calculations,  only  a 
nominal  fixed  cost  was  assigned  to  the  cargo .  This  does  not  account  for  the 
rapid  escalation  of  the  value  of  a  military  cargo  delivered  to  the  front  when 
it  is  needed.  The  cost  of  the  risk  of  development  considers  only  the  cal¬ 
culated  system  failure  rates  and  their  escalated  values  during  system 
development.  There  are  still  the  risks  of  unpredicted  or  unpredictable 
problems.  These  problems  could  be  improper  system  or  component  failure 
rates,  environmental  conditions  not  as  predicted  with  possible  multiple  or 
nonrandom  failures  occurring,  and  unforeseen  failure  modes.  These  problems 
are  primarily  of  concern  for  the  fly-by-wire  system,  since  it  alone  has  no 
mechanical  backup  system  to  assure  that  the  crew  will  have  a  means  of  getting 
hone,  should  a  control  axis  go  out  of  control.  With  these  considerations  in 
mind,  the  fly-by-wire  and  the  fly-by-wire  with  mechanical  backup  systems 
were  chosen  as  the  two  candidates.  The  two  systems  are  very  close  in  net 
costs  to  the  Air  Force,  with  the  fly; by- wire  at  about  $9.6  X  10^  with  a  loss 
of  control  probability  of  8.89  X  10'°,  compared  to  the  fly-by-wire  with 
mechanical  backup  at  $8.3  X  10^  with  a  loss  of  control  probability  of  5.8 
X  10'^.  This  indicates  a  loss  of  control  ratio  of  0.7  in  favor  of  the  fly-by¬ 
wire  with  mechanical  backup,  with  a  cost  ratio  of  about  0.86.  It  is  for  these 
reasons  that  the  fly-by-wire  with  mechanical  backup  was  selected  as  the 
control  system  for  the  MST. 
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SECTION  IV 


CONTROL  COMPONENT  REQUIREMENTS 

Since  the  fly-by-wire  system  was  selected  as  most  appropriate  for  the 
MST,  requirements  for  the  major  components  of  such  a  system  have  been 
evaluated.  These  major  components  consist  of  the  electronics,  the  command 
and  inertial  sensors,  gain  control,  and  the  servos. 


ELECTRONICS 

There  are  two  basic  electronic  computation  means  available  with  which 
to  mechanize  the  required  system  control  laws,  These  are  digital  and  analog 
and,  of  course,  a  mix  of  these.  The  performance  levels  of  both  computing 
methods  may  be  considered  adequate.  Considering  only  the  control  system, 
analog  techniques  are  recommended.  This  is  due  primarily  to  the  lower  cost 
and  complexity  level  of  the  analog  system,  compared  to  the  digital  system. 
This,  in  turn,  is  primarily  due  to  the  fact  that  a  system  of  this  type  has 
inherent  analog  characteristics  such  as  angular  rate  and  acceleration,  pilot 
control  displacement,  and  output  actuator  shaft  position.  The  simple 
straightforward  computational  requirements  of  this  system  simply  do  not 
warrant  the  complexity  of  digital  techniques. 

Since  the  basic  system  sensors  are  ac  in  nature,  a  common  ac-dc  signal 
format  is  recommended.  This  implies  ac  signal  transmission  and  operations 
with  conversion  to  dc  for  dynamic  operations  (signal  shaping)  and  valve 
operation.  This  conversion  is  readily  and  accurately  achievable  with  present 
electronics. 

The  electronics  should  contribute  only  those  functions  built  into  them. 
The  electronics,  exclusive  of  built-in  shaping  network,  have  a  frequency 
response  flat,  to  within  ±10  degrees  of  phase  shift,  to  at  least  200  radians 
per  seconds.  All  redundant  functional  electronic  blocks  (such  as  shaping 
networks)  built  into  the  system  shall  have  predictable  characteristics  and 
be  matched  to  within  £2.5  percent  of  each  other.  Redundant  gain  scheduling 
blocks  shall  have  predictable  characteristics  and  be  matched  to  within  £7,5 
percent  of  each  other.  From  end  to  end  (that  is,  from  sensor  input  to  servo 
displacement  command) ,  redundant  electronics  blocks  shall  have  predictable 
characteristics  matchod  to  within  £10  percent  of  each  other. 
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COMMAND  SENSORS 


Two  pilot-control  sensor  systems  are  possible.  These  are  redundant 
force  sensors  installed  in  both  the  pilot's  and  copilot's  column  and  wheel, 
or  a  set  of  redundant  displacement  pickoffs  placed  across  the  feel  bungee. 
The  former  system  has  been  proposed  for  many  applications;  however,  its 
reliability  and  mechanizational  superiority  have  yet  to  be  field  proven,  and 
its  cost  is  high.  It  was  intended  to  be  used  in  the  F- 111  triple-redundant 
conmand  and  stability  augmentation  system;  however,  due  to  qualification 
problems,  it  was  replaced  by  a  position  pickoff  system.  Such  a  system  has 
been  flight  proven  in  various  installations.  The  installation  of  a  two-axis 
force  transducer  in  the  column  and  wheel  also  compromises  other  normal 
control  functions.  The  functional  advantages  of  direct  force  measurement 
over  indirect  force  measurement  have  never  been  clearly  defined.  For  these 
reasons,  an  indirect  or  position  pickoff  system  is  proposed.  The  ac  linear 
variable  differential  transformer,  LVDT,  or  similar  induction- type  pickoff 
is  recommended.  This  type  of  position  pickoff  has  a  failure  rate  on  the 
order  of  one  tenth  that  of  a  resistive  element  device,  potentiometer,  or 
digital-type  pickoff.  This  favorable  feature  overshadows  the  advantage  of 
being  able  to  use  either  ac  or  dc  with  the  resistive  element  potentiometer. 
These  pickoffs  shall  have  the  following  installed  performances: 

•  Combined  hysteresis,  resolution,  and  threshold  band  less 
than  0.1  percent  of  the  stated  range. 

•  A  gradient  of  input  versus  output  which  is  linear  to.  within 

10  percent  of  the  design  range  when  measured  over  any  10  percent 
increment  of  input. 

•  The  units  shall  have  ranges  which  are  compatible  with  full 
column  and  wheel  displacements. 


INERTIAL  SENSORS 


Rate  gyros  and  linear  accelerometers  are  required  by  the  system.  With 
multiple  sensor  requirements  in  each  axis,  packaging  becomes  a  problem.  The 
number  of  sensors  is  related  to  the  required  degree  of  redundancy  and  disper 
sion  requirements  determined  by  battle  damage/survivability  criteria.  Since 
the  latter  is  boyond  the  scope  of  this  report,  only  the  implications  of  the 
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first  will  he  considered.  If  a  four-channel  system  in  each  control  axis  is 
needed,  the  sensors  might  be  packaged  as  follows: 

•  All  sensors  for  all  axes  are  in  one  package. 

•  All  sensors  for  one  axis  in  one  package  with  three  different 
packages. 

•  One  set  of  sensors  for  one  channel  of  each  axis  in  one  package 
with  four  separate,  but  identical,  packages. 

The  first  concept  is  the  most,  desirable  from  a  logistics  point  of  view. 
A  minimum  number  of  identical  packages  would  be  required;  however,  a  single 
mechanical  or  electrical  failure  or  a  single  shot  could  cause  loss  of  the 
function  in  all  three  axis.  In  the  second  concept,  each  package  would  be 
different  and,  again,  a  single  mechanical  or  electrical  failure  or  shot 
could  cause  loss  of  the  function  in  the  axis  concerned.  The  last  concept 
might  not  work,  because  of  mismatch  due  to  different  package  locations,  but 
It  is  the  most  desirable,  since  each  package  is  identical  and  no  single 
failure  can  cause  the  loss  of  any  axis  of  control.  With  this  concept,  care 
must  be  taken  in  mounting  the  packages,  to  avoid  effects  of  local  vibration 
environment  causing  mismatch  of  redundant  sensor  outputs.  It  is  also 
possible  that  a  single  location  will  not  be  suitable  for  all  sensors  in  all 
axes.  In  such  a  case,  none  of  the  preceding  packaging  concepts  would  be 
suitable. 

There  are  a  number  of  unconventional  sensors  in  the  laboratory  in  the 
development  stage,  such  as  the  solid-state  vibrational  rate  gyro.  These 
sensors  are  not  considered  far  enough  advanced  in  development  to  be  recom¬ 
mended  for  the  baseline  fly-by-wire  system;  therefore,  conventional  spring 
restrained  rate  gyros  and  linear  accelerometers  are  recomended . 

Failure  rates  on  the  order  of  3. S  X  10  5  for  gyros  and  2.0  X  10  ^  for 
accelerometers  can  be  expected.  These  conventional. sensors  shall  have  the 
following  general  requirements: 

•  A  natural  frequency  no  less  than  60  radians  per  second  and 
a  damping  ratio  between  1  to  O.S. 

•  A  combined  hysteresis,  resolution,  and  threshold  band  less 
than  0.1  percent  of  stated  range. 

•  A  gradient  of  input  rate  or  acceleration  versus  output  which 
is  linear  to  within  10  percent  of  the  design  range,  measured 
over  any  10  percent  increment  of  input. 


The  sensors  shall  have  the  following  stated  ranges: 


Roll  rate: 

Pitch  and  yaw  rate: 
Pitch  acceleration: 
Y-axis  acceleration: 


±100  deg/sec 
±20  deg/sec 

-1  to  +4  g  acceleration 
±1  g  acceleration 


GAIN  CONTROL 


The  primary  goal  of  gain  adjustments  in  any  control  system  is  to  main¬ 
tain  the  control  system  air  vehicle  gain  at  a  desired  level  when  the  air 
vehicle  gain  varies,  As  the  response  of  the  air  vehicle  to  applied  moments 
changes  as  a  function  of  flight  condition,  it  is  desirable  to  alter  the  gains 
between  the  pilot’s  controls  and  inertial  sensors  and  the  control  moment 
generating  devices.  There  are  two  basic  means  available  to  achieve  the 
required  gain  adjustments  -  the  open- loop  parametric  gain  adjustment,  and 
the  self-adaptive  teclmiques.  These  two  basic  techniques  are  discussed 
briefly  in  the  following  paragraphs. 

OPEN- LOOP  PARAMETRIC  CONTROL 

This  is  conceptually  the  simplest  means  of  adjusting  control  system 
gains.  The  parameters  affecting  the  response  of  the  air  vehicle  to  applied 
moments  are  measured  in  an  open- loop  fashion  and  used  to  adjust  the  control 
system  gains.  These  parameters  are  normally  measurable  quantities  such  as 
air  data  and  air  vehicle  configuration  parameters.  The  gain  controlling 
parameter  is  usually  defined  in  terms  of  voltage  or  mechanical  position 
which  can  be  transformed  into  a  voltage.  These  voltages  can  he  shaped,  as 
required,  into  nonlinear  functions  of  the  parameters  represented.  The 
control  system  signals  that  require  gain  scheduling  are  also  in  the  form  of 
voltages.  The  gain  control  and  the  signal  voltages  can  be  fed  to  an  elec¬ 
tronic  multiplier  capable  of  taking  the  product  to  several  variables, 
providing  an  accurate  ami  flexible  means  of  gain  scheduling. 

Tlie  major  problem  with  the  parametric  gain  scheduling  system  is  the 
requirement  for  preknowledge  of  the  response  of  the  air  vehicle  to  character¬ 
istics  as  a  function  of  the  gain  scheduling  parameters.  These  characteristics 
will  usually  be  quite  well  defined,  but  flight  testing  must  include  checking 
actual  flight  control  system  performance  against  predicted  performance. 


ADAPTIVE  GAIN  CONTROL 

Honeywell,  General  Electric,  and  others  have  developed  several  versions 
of  an  adaptive  controller  which  used  other  principles  for  gain  control.  One 
Honeywell  controller  for  the  longitudinal  mode  control  automatically  compen¬ 
sates  for  the  change  in  elevator  effectiveness  without  the  use  of  external 
air  data  inputs.  This  is  accomplished  by  maintaining  the  forward  loop  gain 
at  a  value  which  forces  a  pair  of  conplex  closed-loop  roots  to  remain  near 
the  imaginary  axis.  The  complex  roots  result  from  the  electrohydraulic 
servo  and  load  dynamics.  The  lightly  damped  oscillation  is  sensed  in  the 
output  of  the  servo,  and  this  information  is  used  to  adjust  a  variable  gain 
element  in  the  controller.  To  use  the  technique  described,  the  natural 
frequency  of  the  oscillation  employed  must  be  chosen  such  that  any  other 
vibrational  inputs  to  the  system  from  the  rate  sensor  are  not  sensed.  Also, 
the  servo  output  amplitude  resulting  from  the  oscillation  must  be  small 
enough  so  that  aircraft  motions  produced  are  not  evident  to  the  pilot. 

Some  degree  of  preknowledge  of  the  aircraft  gain  characteristics  over 
the  flight  regime  is  still  required;  however,  this  is  generally  not  con¬ 
sidered  a  problem.  The  major  problem  with  this  gain  adjustment  concept  is 
its  extreme  sensitivity  to  fuselage  flexibility.  Optimum  servo  natural 
frequencies  are  generally  of  the  same  order  of  magnitude  as  those  of  the 
first  fuselage  elastic  mode.  The  elastic  mode  frequencies  are  affected  by 
fuel  loads,  dynamic  pressure,  external  and  internal  stores,  and  configura¬ 
tions,  as  are  the  short-period  aerodynamic  modes.  The  problem  is  one  of 
forcing  the  self-adaptive  oscillation  mode  to  a  point  between  the  short- 
period  aerodynamic  and  first  fuselage  elastic  modes  that  will  not  adversely 
affect  either.  Again,  considerable  flight  testing  is  required  to  verify 
predicted  performance  against  actual  performance.  This  gain  adjustment 
•echniques  does  not  lend  itself  to  input  command  gain  variations,  as  are 
•equired  in  the  control  augmentation  system;  also,  feedback  phasing  of 
attitude  rate  signals  cannot  be  readily  handled  with  self-adaptive 
techniques . 

The  degree  of  electronic  complexity,  "proof  flight  testing,  and  input 
and  feedback  gain  phasing  is  comparable  between  the  two  gain  techniques; 
therefore,  the  parametric  concept  is  recommended  for  the  M5T  control  system. 

GAIN  CONTROL  DEVICES 

The  devices  selected  are  small,  individual  differential  pressure  trans¬ 
ducers  positioning  LVDT's,  one  for  each  redundant  channel.  The  reason  for 
selection  of  this  technique  rather  than  depending  on  a  central  air  data 
computer  was  to  maintain  the  required  redundancy  and  redundant  channel 
isolation.  Four  pickoffs  on  a  single  shaft  in  a  central  air  data  computer 
would  not  have  provided  acceptable  redundancy,  and  would  have  posed  a 
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signal  power  and  reference  interface  problem.  It  is  envisioned  that  the 
transducers  could  readily  be  mounted  in  convenient  locations  determined  by 
pneumatic  plumbing  and  wire  routing  trade-offs. 

Few  reliability  data  are  available  on  this  type  of  component;  however, 
it  can  be  considered  the  equivalent  of  a  pneumatic  bellows,  a  microsyn-type 
pickoff,  two  pneumatic  joints,  and  a  rugged  housing.  This  combination  is 
estimated  to  have  a  failure  rate  of  7.5  X  10'6/hour.  The  devices  must  also 
have  tlie  following  performance: 

•  Linearity  of  5.0  percent  when  measured  over  any  10  percent 
increment  of  input. 

•  A  combined  hysteresis,  resolution,  and  threshold  no  greater 
than  0.5  percent  of  rated  output. 

•  A  natural  frequency  of  20  radians  per  second  with  a  damping 
ratio  between  0.6  and  1.0. 


SERVO 


The  most  critical  area  for  a  fly-by-wire  flight  control  system  is  the 
selection  of  a  suitable  means  to  actuate  the  control  surfaces  in  proportion 
to  electrical  command  signals.  Intermediate  actuators  also  serve  as  a  final 
level  signal  selector  or  voter;  hence,  the  reliability  of  the  servo  actuator 
chosen  must  be  compatible  with  the  upstream  electronics.  Consider  the 
following  general  approaches  to  the  surface  actuator  problem: 

1.  Replace  conventional  hydromechanical  surface  actuators  with 
some  type  of  electromechanical  actuator;  i.e.,  a  power  hinge 
coupled  to  an  electric  or  hydraulic  motor  through  high-per¬ 
formance  clutches.  This  approach  requires  a  long  leadtime  to 
develop  components  with  required  performance  and  reliability. 

2.  Retain  conventional  hydrcmechanical  surface  actuators,  and 
provide  the  mechanical  inputs  to  the  hydraulics  surface 
actuators  with  secondary  sorvos  similar  to  the  series  or 
parallel  position  servos  in  automatic  flight  control  systems. 

Due  to  the  tested  performances  and  reliability  of  standard 
tandem  surface  actuators  and  the  availability  of  servos,  this 
approach  ha s  been  selected. 

Hie  next  problem  area  is  selection  of  an  electromechanical  or  electro- 
hydraulic  secondary  servo  actuator  which  is  capable  of  responding  to  manual 
input  and  augmentation  input  signal  frequencies.  Electromechanical  servos 
are  only  marginally  acceptable  due  to  their  limited  ability  to  meet  dynamic 


rcqui reiHc-nts.  An  electromechanical  servo  consisting  of  an  ac  or  dc  servo 
motor,  gearbox,  ball  or  acme  screw,  and  both  rate  and  position  feedbacks  can 
be  designed  with  a  sufficient  bandwidth  for  augmentation  signals  by  using  an 
>'i  off  controller  or  linear  controller  with  compensation.  The  reliability 
of  such  a  unit,  however,  is  seriously  reduced  under  cycling  conditions.'  .An 
electromechanical  servo  actuator  concept  which  could  meet  the  dynamic 
requirements  employs  a  motor  and  dual -clutch  assembly,  The  motor  is  run  at 
a  constant  velocity.  When  output  motion  is  eownanded,  a  clutch  connects  the 
motor  output  to  a  gear  train  and  ballscrew  assembly.  By  the  use  of  gearing 
and  dual  clutches,  output  in  both  directions  is  attained.  In  order  to  meet 
the  dynamic  requirements,  a  high-response  clutch  (such  as  a  voice-coil-type 
clutch  developed  by  Curtiss  Wright)  is  employed.  The  reliability  of  the 
type  of  clutch  noted  is  doubtful  and  as  yet  unproven.  In  addition, 
performance  of  such  a  clutch  is  generally  unacceptable  in  a  high- temperature 
environment  (T  =  275°  F) .  Because  of  the  arguments  previously  cited,  only 
redundant  electrohydraulic  servos  will  be  conisdered  for  the  study  fly-by- 
wire  system. 

Of  the  various  servos  studied,  none  appears  to  present  a  clear-cut 
advantage;  conversely,  none  appears  to  possess  a  clear-cut  disadvantage, 
compared  to  the  others.  Che  thing  is  common  to  all,  all  were  designed  as 
augmentation- type  servos  intended  to  be  operated  in  parallel  with  a 
hydraulically  powered  mechanical  control  system.  The  outputs  of  these 
servos  were  intended  to  be  mechanically  summed  with  the  pilot's  mechnical 
inputs,  either  directly  or  through  isolating  master  cylinders.  The  summed 
output  is  then  used  to  control  the  final  power  actuator. 

All  of  the  proposed  or  in- current -use  designs  employ  standard  two-stage 
servo  valves  of  a  flow  control  type.  Three  or  four-way  cylinders  integrate 
valve  flow  to  provide  a  linear  mechanical  output.  Position  feedback  is 
electrical  for  some  designs,  and  mechanical  for  others.  All  of  the 
currently  in-use  servos  employ  a  single  piston  push  rod  with  a  single-  or 
dual-tandem  piston  heads,  with  single  output  linkages  connecting  the  unit 
to  the  main  actuator.  The  reliability  of  this  system,  cylinder  body,  push  rod, 
rod,  piston  heads,  seals,  bearings,  and  output  linkages  has  been  considered 
very  good,  compared  to  such  units  as  electrohydraulic  control  valves,  which 
have  a  failure  rate  approximately  20  times  greater.  Historially,  it  has 
been  found  that  this  class  of  mechanical  system  can  be  expected  to  exper¬ 
ience  about  2.5  major  failures  per  million  flight  hours. 

With  tire  preceding  in  mind,  the  proposed  servo  is  a  single  system  with 
dual  outputs  taken  from  both  ends  of  the  piston  head.  It  is  controlled  by  a 
three  or  four* way  valve,  and  uses  an  LVIff  electrical  feedback.  Differential 
pressure  transducers  are  placed  across  the  piston  head.  Uaeh  of  the  four 
servos  is  fed  with  an  independent  hydraulic  and  electrical  supply.  The 
servo  outputs  are  rigidly  tied  together  and  control  the  actuation  system 
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valves  through  dual  load  paths,  sunmed  with  the  dormant  mechanical  backup 
system.  The  loops  are  closed  through  valve  drivers  which  are  controlled  by 
the  difference  between  the  feedback,  the  driving,  and  balancer  signals.  'The 
system  is  balanced  and  monitored  by  means  of  the  differential  pressure  trans¬ 
ducers,  The  pressure  across  the  piston  heads  is  measured  and  fed  to  a  signal 
selector,  along  with  the  pressure  from  the  other  piston  heads.  The  output  of 
signal  selector  is  compared  with  the  individual  piston  head  pressures  and  fed 
back  in  a  sense  to  reduce  the  difference  to  zero.  It  is  beyond  the  scope  of 
this  study  to  close  the  loop  with  all  of  the  finesse  required  by  real  life; 
however,  some  of  the  more  important  closed- loop  features  are: 

*  A  natural  frequency  of  at  least  60  radians  per  second,  with  a 
damping  ratio  between  0.6  to  1.0. 

*  A  combined  hysteresis,  resolution,  and  threshold  no  greater  than 
0.1  percent  of  rated  output. 

*  A  gradient  of  output  versus  voltage  input  which  is  linear  to 
within  5  percent  of  design  range  when  measured  over  any 
10-percent  increment  of  input. 

*  A  maximum  rate  producing  full  output  in  0.5  second. 

The  system  is  provided  with  dual  hydraulic  cutoff  valves.  These  valves 
are  controlled  by  the  output  of  the  pressure  signal  selector  and  the  individ¬ 
ual  pressures.  If  this  signal  cannot  be  reduced  below  a  given  level  in  a 
given  time,  the  system  will  be  cut  off. 
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SECTION  V 


HANDLING  QUALITIES 


All  of  the  candidate  systems,  except  the  mechanical  system,  meet  Level  1 
flying  qualities.  In  these  systems,  air  vehicle  response  is  sensed  and  fed 
back  to  the  aerodynamic  control  surfaces  in  a  sense  to  reduce  the  response. 
This  reduced  response  is  compensated  for  by  added  input  to  the  control  sur¬ 
face.  The  net  result  is  a  quickened  response,  with  final  steady-state  value 
determined  by  the  value  of  the  input  divided  by  the  feedback.  The  systems  of 
interest  here  are  the  mechanical  plus  CASAS  and  the  fly-by-wire  systems.  The 
mechanical  plus  stability  augmentation  system,  while  providing  Level  1  han¬ 
dling  qualities,  has  been  eliminated  because  the  mechanical  plus  CASAS  offers 
better  performance  at  lighter  weight.  With  these  systems,  the  innut  commands 
are  in  terms  of  control  surface  displacements  and  the  feedbacks  are  the  same, 
only  of  the  opposite  sense.  The  reader  is  referred  to  Volume  V,  Part  II, 
"Simulation  Studies/Flight  Control  System  Validation  for  Verification  of 
Flying  Qualities." 

In  the  pitch  axis,  normal  acceleration  and  pitch  rate  are  sensed.  Thes'? 
two  signals  are  fed  tp  the  elevator  with  a  gain  of  1.66°  5e/dog/soc  of  pitch 
rate  and  10.1°  6e/g  of  normal  accelration.  Pilot  input  control  is  fed  to  the 
elevator  with  a  gain  of  5°  6e/in.,  to  the  horizontal  stabilizer  with  a  gain 
of  4°  6h/in.,  and  to  the  spoilers,  for  DLC,  with  a  gain  24°  6s/ in. ,  through  a 
washout  circuit  of  S/(3S  ♦  1).  The  horizontal  stabilizer  and  spoiler  gains 
are  reduced  to  zero  as  a  function  of  flap  setting.  The  pilot  is  provided 
with  a  switch  on  the  control  wheel  to  open  the  input  to  the  DLC  spoilers  at 
will,  and  a  second  interrupt  is  placed  in  series  with  the  throttles  at  full 
forward.  The  pilot  is  also  provided  with  a  switch  to  alle  him  altitude  or 
flight  path  angle  stabilization.  This  function  is  provided  with  a  gain  of 
0,5  degree  of  elevator  per  degree  of  change  in  flight  path  angle  and  about 
0.75  degree  per  1,000  feet  of  altitude.  Trim  is  maintained  by  a  coolie  hat 
switch  on  the  pilot’s  control  wheels.  Activation  of  this  switch  supplies 
trim  to  the  horizontal  stabilizer  at  a  rate  of  Z  degrees  per  second.  A 
function  of  bank  angle  is  fed  to  the  elevator  to  compensate  for  pitch  trim 
changes  when  in  a  banked  turn.  This  function  is  in  the  form  of  sin  $  tan  e. 

In  the  yaw  axis,  yaw  rate  is  sensed  with  a  rate  gyro,  and  lateral  accel¬ 
eration  is  sensed  with  an  accelerometer.  These  parameters  are  fed  back  to 
the  vertical  stabilizer  with  gains  of  100  degrees  per  g  and  5.5  degrees  per 
degree  par  second.  The  surface  deflection  die  to  lateral  acceleration  is 
limited  to  4,5  degrees,  and  yaw  rate  is  fed  through  a  washout  circuit  of 
S/(3S  ♦  1).  The  pilot's  commands  arc  fed  to  the  vertical  stabiliser  with  a 
gain  of  11.35  degrees  per  inch  of  rudder  pedal.  Trim  is  maintained  by 
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of  a  switch  on  the  center  console.  Activation  of  this  switch  results  in 
displacement  of  the  control  surface  at  a  rate  of  0.6  degree  per  second. 

In  the  roll  axis,  roll  rate  is  sensed  with  a  roll  rate  gyro.  This  term 
is  fed  to  the  ailerons  and  outboard  spoiler  panels  with  a  gain  of  0,85  degree 
per  degree  per  second.  The  pilot's  control  wheel  deflections  are  fed  to  the 
control  surfaces  with  a  gain  of  1.0  degree  of  aileron  and  spoilers  per  degree 
of  control  wheel.  Trim  is  supplied  by  the  same  coolie  hat  switch  as  is  used 
for  pitch.  The  trim  is  fed  to  the  ailerons  only  at  a  gain  of  2  degrees  per 
second.  Synchronized  roll  attitude  is  provided  with  a  gain  0.5  degree  of  the 
control  surfaces  per  degree  change  in  roll  attitude. 

With  the  previously  noted  gains,  the  systems  all  perform  essentially  the 
same.  The  mechanical  with  CASAS  provides  control  displacements  of  the  con¬ 
trol  surface  through  master  cylinders  and  servo  displacements,  while  the  two 
fly- by-wire  systems  provide  displacement  through  servo  displacement.  The 
feedbacks  are  strictly  servo  displacements.  In  all  systems,  trim  is  main¬ 
tained  through  the  proper  servos.  Figures  15  and  16  present  analytical  block 
diagrams  of  the  systems.  Level  1  flying  qualities  are  presented  in  each  axis, 
and  the  results  are  presented  in  the  following  paragraphs. 

In  the  longitudinal  axis,  the  short-term  dynamics  are  essentially  the 
same  for  both  takeoff  with  46  degrees  of  flaps  and  71  knots,  and  landing 
with  73  degrees  of  flaps  and  65  knots.  The  natural  frequency  of  the  short- 
period  responses  is  approximately  5.75  radians  per  second,  and  the  damping  is 
approximately  1.  The  long-period  or  phugoid  mode  has  a  natural  frequency  o.f 
0.08  radian  per  second  and  a  damping  ratio  of  at  least  0,2.  In  the  lateral 
directional  axis,  the  dutch  roll  mode  provides  a  natural  frequency  of 
0.4  radian  per  seccni  for  takeoff,  and  1.3  radians  per  second  for  landing; 
the  damping  is  about  0.6  and  1.0,  respectively.  The  spiral  mode  time  con¬ 
stant  is  about  13.5  seconds  for  the  takeoff,  and  about  18  seconds  for  land¬ 
ing.  The  roll  oxis  control  effectiveness,  in  terms  of  the  time  required  to 
change  the  bank  angle  by  30  degrees,  is  about  1.4  seconds  in  both  cases. 

The  roll  rate  time  constant  is  less  than  1  second  in  both  cases.  The 
directional  stability  of  the  aircraft,  with  respect  to  the  sideslip  excursion 
parameter,  is  well  within  the  level  1  requirement  of  Q.L»  at  *  -85°.  All  of 
these  parameters  readily  meet  the  Level  1  flying  qualities  presented  in 
Volume  V,  Part  II,  of  this  report. 
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Figure  15.  Roll  and  Yaw  Axes  of  Control 


SECTION  VI 


CONCLUSIONS  AND  RECOMMENDATIONS 


Mechanization  of  a  fly-by-wire  control  system  that  is  capable  of  meeting 
.-realistic  performance ,  flight  safety,  and  mission  success  requirements  can  be-- 
achieved,  assuming  applicability  cf  available  component  failure  rate  data. 

This  can  be  achieved  with  a  system  using  four  channels  of  sensors  and  elec- 
. ttonics,  with  four  servos  using  four  independent  hydraulic  systems.  These 
servos  may  be  either  force  or  position  summed.  If  force  summation  is  used  the 
valves  must  be  electronically  balanced,  requiring  pressure  transducers.  If 
:the  summation  is  position,  additional  position  transducers  located  at  the 
summation  point  must  be  used  and  fed  back  to  the  individual  servos  to  reduce 
■the  transient  in  the  event  of  a  failure.  The  position-summed  servos  must 
have  at  least  5C  percent  authority  so  that  at  100  percent  authority  will  be 
retained  after  two  failures.  Duality  of  the  output  is  a  must,  and  override 
:  bungees  will  be  required  of  the  position- summed  servos  to  preclude  over¬ 
stressing  of  the  power  actuator  valves  with  the  normal  200  percent  authority. 
If  the  available  control  system  failure  rate  data  is.  applicable,  this  control 
system  coupled  with  normal  cockpit  controls  and  at  least  triply  redundant 
power  actuation  system,  powered  by  individual  hydraulic  supplies,  can  be 
expected  to  turn  in  a  loss  of  control  failure  rate  less  than  10' 5  for  a 
5-hour  mission. 

Available  failure  rate  data,  however,  does  not  include  events  that  may 
lead  to  unpredictable  failures.  These  events  include  utilization  of 
improper  system  or  component  failure  rates,  environmental  conditions  not  as 
predicted  with  resultant  multiple  or  nonrandom  failures,  inadequate  monitoring 
to  insure  against  unknown  failures  in  redundant  components,  and  unforeseen 
failure  modes.  It  is  for  these  reasons  that  a  four-channel  system  with  force 
summed  servos,  coupled  in  the  pitch  and  roll  axes  with  a  normally  dormant 
single  mechanical  control  system,  is  being  recommended  for  the  MST.  The  nor¬ 
mally  dormant  mechanical  control  system  would  provide  the  MST's  crew  with  a 
means  of  getting  home  in  the  event  of  an  unforeseen,  or  foreseen,  fly-by-wire 
control  system  failure. 

Since  fly-by-wire  systems  offer  promise  for  application  in  future  opera¬ 
tional  aircraft,  it  is  recommended  that  their  development  continue  to  be  pur¬ 
sued.  To  this  end,  it  is  recommended  that  the  operational  utilization 
include : 


1.  A  set  of  normally  dormant  single  mechanical  control  systems  as  a 
backup  in  the  first  generation  of  fly-by-wire  operational  control 
systems,  for  the  pitch  and  roll  axes. 
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Extended  application  of  available  maintenance,  accident, 
incident,  and  abort  rate  data  to  the  definition  of  realistic 
operational  component  failure  rates  for  future  control  systems 
utilization. 

Development  of  high  flow  rate  electrohydraulic  valves  suitable 
for  direct  electrical  control  of  fly-by-wire  surface  control 
power  actuators  be  continued. 


